LISBON AGENDA*

Sign in, collect your badge, get caffeinated, and check out this year’s merch!

Welcome, a brief introduction, and the Capture the Flag Kickoff!

— Victor Julien

— William Hedenskog & Nicklas Keijser

Operational Technology (OT) networks are often part of critical infrastructure, such as power
grids. They were traditionally air-gapped from the public Internet, but now they are becoming
more digitalized and open to the Internet, which introduces security issues and an increased
attack surface. Compromising an OT network device has a real-world impact, as seen in the
attacks on the Ukrainian power grid that cut electricity for around 230,000 consumers.

The devices in OT are often incompatible with endpoint monitoring, leaving network
monitoring as the only option for detecting threats. The goal of this talk is to develop network
fingerprints for Remote Management and Monitoring (RMM) software, VPN clients and
protocols, and the emerging OT standard OPC Unified Architecture (OPC UA), and
implement them in Suricata.

RMM tools are increasingly abused to perform lateral movement and often operate over
encrypted traffic such as TLS. To detect these tools, we leverage plaintext traffic such as
mDNS/DNS and HTTP, and fingerprint the unencrypted TLS Client Hello messages with
JA4, TLS SNIs, and certificates. We successfully identify 8 popular RMM tools, including
TeamViewer and AnyDesk.

Virtual Private Networks (VPN) create blind spots for the Intrusion Detection System (IDS)
and detecting VPN usage provides critical indicators of compromise. VPNs send mandatory
unencrypted traffic when establishing encrypted tunnels, and we fingerprint these packets to
detect 7 VPN clients and 12 VPN protocols, with additional fingerprints for obfuscated
WireGuard.

OPC UA provides interoperability between OT devices such as logic controllers that normally
utilize vendor-specific protocols, while also providing authenticated and encrypted
communication via certificates. We present a fingerprinting method for distinguishing
between OPC UA vendor implementations with a JA4-inspired fingerprint that can be used to
detect unauthorized OPC UA software. To complement this, we also demonstrate how JA4X
certificate fingerprinting can be applied to OPC UA to detect default configurations and
spoofed certificates. Our work uniquely fingerprints and identifies 10 OPC UA
implementations.

— Erik Vanderhasselt

This talk presents an experiment deploying Suricata on a honeypot to analyze SSH-based attacks. The goal is to explore how active defense can compel attackers to reveal their tactics by examining the interactions captured. By leveraging Suricata, we not only collect logs and binary artifacts but also capture network traffic, providing deeper visibility into attacker behavior. We will discuss the setup, the types of alerts and patterns observed, and how these insights might inform defensive strategies. Attendees will gain an understanding of the experiment’s design and its potential to expose attacker methods.

Take a walk!

— Champ Clark

When a successful cyberattack occurs, one of the first questions asked is: “What data did the attacker have access to?” Answering this critical question is often difficult, as modern data is spread across various networks, clouds, and devices. While many powerful commercial tools exist to solve this, their cost often puts them out of reach for most organizations.

Many of these tools leverage Large Language Models (LLMs) to identify sensitive information, but the mere mention of “AI” often triggers concerns about massive overhead and expense. The reality is that by using “open-weight” models, you can run efficient LLMs locally to identify sensitive data and where it resides — without the enterprise price tag.

This talk introduces Highvolt, a new open-source project from Key9, Inc. designed to tackle data detection in a way even commercial vendors often miss: detecting data in motion. By leveraging Suricata’s file extraction capabilities, Highvolt analyzes files “off the wire” in real-time to determine — and remember — if they contain sensitive information. Best of all? No high-cost LLM subscriptions or cloud APIs are required; this talk will demonstrate how to run your own local models to keep costs down and data private.

— Peter Manev

Effective threat hunting requires more than just good intel and tools; it demands a minimum baseline understanding of the specific environment you are defending in combination with expertise of the tools available. Drawing on work experience from the cyber trenches this talk introduces the HHAMMERR concept.

Threat hunting is too often treated as a temporary, isolated exercise with high pressure timeline triggered by an incident. We discover a threat, investigate it, and move on — but rarely do we extract the maximum long-term value from the effort to operationalize it better on all levels possible.

Suricata concentrates a lot of power and visibility for the blue teams and enables them to shed light in the dark and blind spots of your defense perimeter. As such, it is perfect for providing the extra layer of protection for the organisation and end users implementing the concept. Deploying Suricata generates a lot of data, and hunting recipes “gotchas” that need to be tackled continuously.

The HHAMMERR concept is born out of many repetitive failures and success experiences in over 15 years of real-world threat hunting. At its core it comprises the following :

Hypothesis & Hunt (Initiation): The process begins by formulating a theory based on threat intel or past experience (Hypothesis), which is then put into action by a specific catalyst — like a news event, bug report, vulnerability disclosure, or security alert (Hunt Trigger).

Analyze & Modulate (Deconstruction): After the hands-on hunt concludes, teams review the results to identify successes, failures, and gaps (Analyze). The workflow is then broken down into functional, distinct blocks based on the data and infrastructure used (Modulate).

Manage & Enhance (Automation): Each isolated block is evaluated to determine if and how it can be automated (Manage). These pieces are then unified to build an end-to-end automated process designed to drastically reduce response and detection times (Enhance).

Refine & Repeat (Continuous Improvement): The newly automated workflow is tuned based on real-world feedback from production deployment (Refine). Once optimized, the team absorbs the technological and organizational lessons learned and moves on to the next target (Repeat).

The talk aims at sharing the concept as a practical blueprint to stop hunting the same threats manually more than once, ensuring every hunt permanently elevates their organization’s security posture. It will concentrate on useful hands-on scenarios and actual hunt examples with Suricata from advanced Red Team tools and exercises.

Léargas Security — Community Leader

Grab something to eat and mingle.

— Koen Teuwen

Suricata rules determine what triggers alerts, what analysts need to triage, and which attacks may be missed. When rules are too broad, brittle, or poorly tested, the result is familiar to many practitioners: excessive false positives, missed attack variants, tuning effort, and alert fatigue.

This talk is about improving alert quality at the source. Drawing on lessons from Suricata-focused research and tooling, practical ways to write, test, lint, and teach better Suricata rules are covered. We start from a simple observation: tools that automate alert triage are limited when the quality of the alert stream itself is limited. Instead of post-processing, a more efficient way to improve alert quality is therefore to engineer better rules.

The session will cover concrete design principles for lower-noise rules, with an emphasis on both coverage and specificity. These ideas can be operationalized using suricata-check, an open-source tool that acts as a linter for Suricata rules and can support rule review, ruleset ingestion, and CI workflows.
The talk will also look at what makes rule writing difficult in practice. Lessons learned inform not only practices of rule engineers themselves, but also of organizational practices around them as enablers. While learning rule engineering may take place on-the-job, formal training procedures may benefit SOC staff, including analysts who must interpret why rules trigger the alerts they investigate. Supporting rule engineering trainings, SuriTrain is introduced as a platform for hands-on Suricata rule-writing exercises with realistic scenarios, capable of assessing rule generalizability, providing automated feedback, and providing insight into trainee performance.

Attendees will leave with practical takeaways for reducing alert noise before it reaches analysts and for building stronger Suricata rule-writing workflows.

— Samaresh Kumar Singh

Running Suricata in a datacenter is one thing. Running it reliably across hundreds of heterogeneous edge nodes with variable bandwidth, limited compute, and no guarantee of connectivity is another problem entirely. This talk shares hard-won lessons from deploying and operating Suricata at scale across distributed edge infrastructure, covering everything from rule set pruning and performance tuning to telemetry pipelines and centralized detection management.

We discuss how to adapt Suricata’s threading model and AF_PACKET/DPDK configurations for edge-class hardware, how to build lightweight rule distribution and versioning pipelines that survive intermittent connectivity, and how to integrate EVE JSON output into broader security orchestration workflows. We also cover operational realities: alert fatigue, tuning cadence, handling rule conflicts across heterogeneous deployments, and building feedback loops that actually improve detection quality over time.

This talk is for practitioners who want Suricata to do real work in hard environments, not just lab benchmarks.

— Randy Caldejon

This talk presents an open-source RTPS application-layer parser for Suricata 8, written in Rust, that gives ROS 2 deployments network-level visibility into their own middleware traffic. The parser supports detection signatures for rogue participants on the discovery domain, unauthorized publishers on safety-critical topics, GUID prefix anomalies, and malformed submessage fuzzing. Validation uses live capture from a wheeled UGV running ROS 2 with Nav2 and a SLAM stack on a proving ground.

Air squats!

— Shivani Bhardwaj

Dependency resolution is an age-old NP-complete** problem with certain cases even crossing into the NP-Hard boundary. This was not a known fact to the speaker until she picked up a seemingly easy problem of resolving dependencies among flowbit rules and then, what looked like a matter of picking up and applying just the right sorting algorithm, became a problem that produced new edge cases every other day.

This talk will cover the complexity of the problem at hand, how dependency resolution in general is a hard problem to solve, whether we were able to solve the problem finally, and what more could possibly be done to improve the solution.

This talk is aimed at developers and researchers who want to know the impact of what may look like a small and esoteric problem, and how something like this fits into an even more complex state machine of a project as big and intricate as Suricata.

**well, not always…

— Sake Blok

Wireshark has a lot of features to make your analysis more effective and more efficient. In this session, Sake (one of Wireshark’s core-developers) will showcase some of Wireshark’s most powerful features that might not be known to you. How to create profiles to distinguish different analysis tasks. How to use colouring to easily spot what you are looking for. How to use filter buttons to quickly zoom in and out. How to make use of the filtering options that were added since version 4.0. How manual name resolving helps in understanding the packet flows and prepares for screenshots for your reports. How to document your findings in the pcapng file itself.

All-in-all a big refresher on your Wireshark packet analysis skills!

Napatech — Community Partner

Community Discussion Recap

See you tomorrow!

Eat, drink, and mingle.

Sign in, collect your badge, and get caffeinated!

Welcome again!

— Patrick Kelley

Industrial control systems remain dangerously opaque to traditional network security monitoring. Protocols like S7comm, IEC 60870-5-104, Modbus, DNP3, and EtherNet/IP-CIP carry commands that can halt turbines, open valves, or reprogram PLCs, yet most deployments treat them as undifferentiated TCP traffic.

This talk presents a purpose-built Suricata extension framework we developed for deep OT/ICS protocol inspection. he centerpiece is a new S7comm application-layer analyzer for Suricata, built specifically for this conference, that provides full protocol dissection of Siemens S7 traffic including function code identification, PLC program upload/download detection, and CPU state-change monitoring. We will walk through the architecture of this and other custom Suricata application-layer parser plugins (compiled as shared objects loaded at runtime) that give Suricata native understanding of S7comm function codes, IEC-104 ASDU types, and other fieldbus semantics. Each plugin ships with curated detection rulesets organized by allocated SID blocks and mapped directly to MITRE ATT&CK for ICS techniques, enabling analysts to immediately contextualize alerts against known adversary behaviors.

We will demonstrate the full offline PCAP analysis pipeline: Suricata runs with mid-stream parsing enabled (critical for SPAN/tap captures of long-lived PLC sessions), ICS plugin rules are merged dynamically only when the corresponding parser is present, and eve.json alerts are enriched with ICS protocol attribution and ATT&CK technique IDs. Extracted files are automatically routed to YARA scanning while log artifacts go through Sigma/Zircolite detection, creating a multi-engine analysis chain from a single capture file.

Attendees will gain practical knowledge of how to build and deploy custom Suricata protocol parsers for OT environments, how to structure SID-to-ATT&CK mappings for operational relevance, and how to close the loop between passive detection and proactive attack-path analysis without ever touching production control systems.

— Jamie Lavigne & Vikrham Saurabh

Suricata 8.0 introduces Firewall Mode, an experimental capability that fundamentally extends Suricata beyond IDS/IPS into a drop-by-default access control engine. Firewall Mode evaluates traffic at explicit connection-state hooks, enabling stateful layer 7 access control decisions — such as allowing TLS only to approved domains — with predictable, first-match-wins semantics that traditional IPS rule evaluation could not reliably deliver.

AWS Network Firewall (ANFW) is a managed stateful firewall service deployed within VPCs. Customers route their VPC traffic through a Network Firewall endpoint, which forwards the traffic to EC2 instances behind a load balancer running the Suricata engine. ANFW has a implemented a new firewall feature using Suricata’s new firewall mode capability, bringing it to one of the largest managed cloud-based network security services. Our implementation introduces a two-stage inspection pipeline that cleanly separates access control from threat detection, with each stage carrying independent rule capacity and evaluation semantics. Bringing an experimental Suricata feature to a high-availability managed service at cloud scale required close collaboration with OISF team, contributions to the upstream Suricata project, and careful integration work spanning the dataplane configuration pipeline, flow state handling, and logging infrastructure. This talk shares what we built, what we learned, and where we see Firewall Mode evolving next.

— Éric Leblond

This talk introduces the Stamus AI tools, a suite of agent plugins dedicated to Suricata, focusing on their architecture, design, and integration with the foundational Suricata Language Server (SLS). The session will show how the tools are built and used, with the source code available at https://github.com/StamusNetworks/stamus-ai-tools.

The Stamus AI tools provide three core features: PCAP analysis, rules analysis, and rules writing. The talk will specifically showcase the LLM’s capability to analyze a PCAP file directly, identifying threats and associated Indicators of Compromise (IOCs) without reliance on pre-existing signatures.

The rule writing feature is supported by a fundamental design built around a feedback loop that is essential for the Large Language Model (LLM) to function accurately. This loop integrates diagnostics and information coming from Suricata Language Server and includes capabilities such as fetching documentation from the official Suricata documentation website to assist with the syntax of some keywords. This architecture ensures that leveraging the Suricata Language Server is the key to helping the AI generate correct and verified signatures.

On top of that, the rules writing skill includes a series of human written guidelines designed to ensure that the AI generates production ready signatures. Ultimately, this framework accelerates the process of processing network traffic data, extracting critical threat information, and generating verified Suricata rules for deployment.

— Filipi Pires

The modern credential theft kill chain is loud on the wire and quiet on the endpoint. Endpoint tools watch for LSASS access. Suricata watches the stager land, the C2 heartbeat pulse, and the credentials leave.

This talk walks the full chain against Windows 11 and shows what Suricata sees at every step. An HTA payload delivered via msfvenom. A Meterpreter reverse TCP session. Browser credential theft against Chrome and Edge with DPAPI extraction. In-memory keylogging after migration to explorer.exe. UAC bypass through fodhelper. LSASS and SAM dumping with Kiwi and DPAPI_SYSTEM master key recovery. Every step mapped to MITRE ATT&CK.

The detection thesis is simple. Meterpreter staging leaves a network footprint that survives TLS, and Suricata pins it. Stager size, JA3 fingerprint, and keepalive timing all become signatures. The DPAPI and SAM exfiltration produces flows with characteristic size and timing that Suricata catches through flow and size keywords.

The Suricata ruleset covers stager detection, keepalive timing, browser exfiltration patterns, LSASS dump bursts, and Metasploit listener IOCs. Every rule runs against real traffic in a live demo.

Attendees leave with the Suricata rule pack, the PCAPs, the JA3 fingerprints, and the published technical article.

Jog in place!

— Charles Blanc-Rolin

Legacy Operating Systems, Real Time Operating Systems, black box devices using special protocols, no EDR available, system logs that are difficult to collect… Monitoring the security of OT devices can prove challenging for most security tools on the market. Find out how Suricata helped me to detect malicious activity, particularly on medical devices.

— Susan Hinrichs

Our group has created a distributed cloud firewall (DCF). It provides an intent-based security policy which is implemented over Linux-based gateway policy-enforcement points (PEPs) deployed in the user’s cloud environment along the routing paths between cloud network areas, e.g., virtual private clouds (VPCs). The DCF controller translates the intent-based policy to the appropriate set of rules that must be enforced at each PEP.

The PEPs enforce the policy filtering rules through a combination of extended Berkley Packet Filter (eBPF) programs for layer 4 filtering and a proxy, Apache Traffic Server, to enforce layer 7 filtering. We also use Suricata to implement the Intrusion Analysis feature. Initially, we integrated Suricata purely for Intrusion Detection. In the last year, we changed the architecture so we can also use Suricata for Intrusion Prevention.

In this talk, I will describe the gateway architecture and discuss some of our design decisions and challenges with respect to our changing Suricata integration.

Profitap — Community Partner

Grab something to eat and mingle.

— Soner Tari (virtual)

At PreSuricon last year, we proposed a theoretical architecture to eliminate the encrypted traffic “blind spot” caused by modern protocols like HTTP/2 and QUIC-based HTTP/3. While passive wire-sniffing falls short, we envisioned a standardized path forward: decoupling decryption from detection by passing cleartext payloads from SSLproxy via an extended ICAP layer, preserving original 5-tuple context using custom X-headers.

This presentation marks the realization of that vision. We introduce icapsuricata, an open-source c-icap service module, and a new ICAP subsystem in SSLproxy, which in combination turn last year’s architecture into a reality. Instead of relying on traditional external network interfaces or DAQ modules, icapsuricata embeds libsuricata directly into the ICAP server using its native C API. On the other end, SSLproxy wraps decrypted content as ICAP requests and sends them to icapsuricata and possibly to other configured ICAP services in chain. Crucially, this architecture completely renders obsolete the expensive Divert mode of operation in SSLproxy, which represents a functional dead-end for multiplexed protocols like HTTP/2 and HTTP/3.

We will explore the technical milestones achieved over the past year. We will explain how we solved programmatic inline stream emulation inside libsuricata, managed stateful TCP reassembly through synthetic ACK window thresholds in icapsuricata, and successfully navigated GPL licensing constraints that blocked direct libsuricata integration into SSLproxy. We will detail the critical features implemented within the SSLproxy ICAP subsystem — including our custom ICAP specification adaptations and dynamic service chain management. Furthermore, we will talk about challanges ahead with HTTP/2 and HTTP/3.

This ICAP approach, utilizing Suricata (libsuricata), c-icap, icapsuricata, and SSLproxy, provides a scalable, future-proof mechanism for active inline threat prevention at the gateway layer. We now have the opportunity to build the first open-source security stack that truly supports not only HTTP/2 but also HTTP/3 — finally allowing us to unblock UDP port 443 without sacrificing visibility.

— Markus Kont

Detection engineering for network threats has a dirty little secret: most researchers are working with faulty data. Useful PCAPs of real attacks are hard to come by. They are either locked away in private networks, stripped of the context that would tell you whether a flow is actually malicious, or – worst of all – they capture isolated events when the actual attacks are chains of behavior across multiple systems. To make things even more difficult, effective detection engineering requires expertise in both attacker and defender tradecraft simultaneously. That’s a lot for a single researcher to master, and it means that the field itself is slower to advance.

Built upon work already presented in Suricon 2025 and 2024, I will demonstrate a simple cyber range for fast-tracking detection research. This time with a sprinkle of AI. In the heart is Ansible deployment playbooks that build a set of target machines along with attacking C2 server and detection stack. Models are railroaded by skills and MCP servers to resolve cyber range inventory and orchestrate adversary simulation experiments, followed by detailed feedback. Findings and telemetry from each run are automatically fetched and frozen, to be consumed by detection engineering followup. That includes detailed write downs about the attack technique, proposed detection methods, related EVE events, victim endpoint context, and even full PCAP dump.

Work is split into two distinct phases. Firstly, the initial attack technique study and lab evolution by using a capable coding model. This creates the harness used in the second phase where low-cost and locally deployable models can be used to drive the lab in an established harness. Here the focus is dissecting the actual network telemetry produced by Suricata.

May the demo gods be merciful.

— Sam Mohammad

With the current geopolitical situation escalating in the Middle East as Iranian-linked threat actors continue to evolve, moving beyond simple commodity malware toward sophisticated, identity-centric operations, defenders must shift their focus from static Indicators of Compromise (IOCs) to behavioral profiling. This talk leverages Suricata to provide a practical framework for mapping Iranian APT lifecycle behaviors across attack surfaces and translating them into actionable, behavior-driven detections. The core of this presentation focuses on the methodology of translating these intelligence-driven behaviors into high-fidelity Suricata signatures. The talk will begin with a rapid intelligence synthesis/brief, examining Iranian APTs tradecraft evolution, identifying the unique “fingerprints” left by these actors that can ultimately be translated into network-based detections.

Touch your toes!

— Corey Thomas & Peter Manev

In this talk, we dive deep into the trenches of building and managing a high-performance HW QA lab for the world’s best team of colleagues and the world’s leading OSS network detection engine — Suricata. We’ll start with a quick refresh on the core purpose of a Suricata HW QA lab and how we automate comprehensive performance and regression reports for every single Pull Request (PR). From there, we will unpack the architectural hurdles of running multibox setups inside CI, old vs new hw, CI and NIC drivers challenges while running different Suricata run modes in parallel, sharing the exact CI configurations used and execute tasks the environment wasn’t originally designed for.

— Ladislav Baco

When an incident occurs, speed and visibility are critical. While EDR tools are powerful, they require deep endpoint integration, broad organizational coordination, and significant deployment overhead. Network Detection and Response takes a different approach. Deployable within minutes, requiring only network-level access. This talk makes the case for network monitoring as a first class citizen in incident response, exploring how open source Suricata can deliver immediate, actionable intelligence with minimal disruption to the affected organization.

We demonstrate this through a simulated phishing attack with malware execution, followed by a live investigation of Suricata’s eve.json logs. By correlating DNS, HTTP, TLS, fileinfo, and flow records, we reconstruct the full attack timeline and identify malicious patterns.

Corelight — Community Partner

TBD — Sign up when you register, first come, first served! (Please, no vendor talks)

TBD — Sign up when you register, first come, first served! (Please, no vendor talks)

TBD — Sign up when you register, first come, first served! (Please, no vendor talks)

Sleep well and see you tomorrow!

— Sake Blok & Peter Manev

Classified data just leaked. The evidence? Buried in pcap files. Your mission: crack esPCAPe — our escape-room-style network forensics challenge. Dig through traffic, chase packets, and expose the leaker before the company’s security guards catch YOU.

Grab your team. Fire up Wireshark. The clock — and the guards — are already moving.

Sign in, collect your badge, and get caffeinated!

Welcome again!

— Kelley Misata

— Konstantinos Margaritis

Vectorscan is a fork of Hyperscan, a massively vectorized regular expression matching library, created in 2020 because of the need for a portable 100% compatible Hyperscan fork. Since Intel decided to make the original Hyperscan project proprietary and closed in 2023, Vectorscan is now the only open source alternative still in active development. We aim to provide better performance than the original, port to more architectures and OSes and enhance the library with more features while remaining true to the open source philosophy. We will be presenting current status, future roadmap, as well as the challenges we have had to face in the past. We will also announce and describe the new collaboration with Suricata and OISF and new opportunities for functionality and performance improvements for Suricata users and developers.

— Ted Skinner

Modern security teams rely on Suricata as a critical detection engine, yet most training focuses on rule writing and traffic analysis rather than operational failure recovery. In real environments, detection failures are far more often caused by misconfiguration, broken pipelines, resource starvation, or log ingestion issues than by missing signatures.

This workshop provides a hands-on, scenario-driven approach to operating Suricata in production. Participants are given a fully functional single-server lab that runs Suricata, a traffic generator, and Splunk in a containerized environment. The system initially operates correctly, generating alerts and normal telemetry.

The lab is then intentionally damaged through a series of realistic operational failures including configuration errors, permissions issues, rule loading problems, logging pipeline failures, interface misbinding, and resource exhaustion. Attendees must use Suricata logs, configuration validation, packet capture, and Splunk visibility to diagnose, troubleshoot, and restore the system to a healthy state.

By the end of the workshop, participants will understand:

• How to validate Suricata health beyond “the service is running”
• How to interpret Suricata startup and runtime errors
• How to troubleshoot rule loading failures and detection blind spots
• How to verify log pipelines into Splunk or other SIEMs
• How to build repeatable health checks for production sensors

This workshop is designed for security engineers, detection engineers, SOC architects, and operators who run Suricata in real environments and want deeper operational mastery of their detection infrastructure.

— Chris Wakelin

Suricata 4.1 introduced “transforms” for a sticky buffer, such as “compress_whitespace”. Suricata 8.0 introduced a curated instance of the Lua language and support was added for transforms to be written in Lua. In this talk we will discuss using Lua transforms that can be used as “libraries” of functions used by several rules, with widely used ones possibly becoming candidates for inclusion in the main rule language. As examples we will show rules using common ciphers implemented in Lua. We will also discuss performance implications of using Lua in this way.

Jumping jacks!

— Juliana Fajardini

What happens when the two sides of a network connection are not seen as part of the same stream flow? What are the challenges in such scenarios? How do you confidently identify them? This talk will present asynchronous streams, why it’s important to identify and handle them, how Suricata does this, and how Suricata Exception Policies navigate this (extra complex) setup.

— Kseniia Naumova

A single alert can be ignored, but correlated alerts tell a story! I will tell how we can use generic Suricata rules not as standalone detections, but as ‘building blocks’ for effective threat hunting mechanism through correlations and behavioral chains.

This talk will focus on practical approaches to building correlations: identifying recurring combinations of generic detections across known malware families, mapping detections to kill chain and MITRE ATT&CK behaviors, and creating custom technique chains designed to identify suspicious activity patterns. Each approach will be demonstrated with real detection examples of rules correlation, including newly discovered or previously unnoticed threats, recurring behavioral patterns, and false positives encountered during the research. Special attention will be given to how researchers can build a home lab using public sandboxes and Suricata to test rules correlations against real malicious traffic.

The goal of this talk is to share practical ideas that can help researchers move beyond single rules and start treating generic alerts as part of a larger story.

TBD — Community Partner

Grab something to eat and mingle.

— Peter Manev

Agentic AI can already do useful things with Suricata’s EVE JSON output — analyze logs, explain findings, identify suspicious patterns — without requiring deep expertise in the underlying data. But “useful out of the box” and “production-ready” are very different bars. When your data isn’t a static file but a continuous stream of network events, and when token costs, hallucinations, and data privacy all become real constraints, the quality of your AI skills files determines whether threat hunting scales or stalls. This talk is about closing that gap.

Recently, the OISF team created a public repository on GitHub dedicated to creating and sharing optimized threat hunting AI SKILLs files specifically for analyzing Suricata-generated network security data.

This talk will review and showcase several of these Agentic AI GitHub repositories for Suricata SKILLs and will walk through the process of streamlining and optimising SKILLs files — with pros and cons — for successful threat hunting with Suricata and Agentic AI.

The benefits of using interactive Agentic AI for analysis of network security data are multiple. It is fast and really easy to run locally. And it produces very good explanations of the analysis and findings. You don’t need to be a data source expert and you can automate the analysis.

However, analyzing huge logs repetitively by itself is not optimal. A different approach is needed for enhancing and controlling/guardrailing these powerful AI tools in order to execute successful analysis and threat hunts in production. In the real world,the data is not a static set of a file or files (eve.json) — but rather a constant stream of events.

When it comes to analysing standard output of Suricata’s eve.json — the common Agentic AI tools deliver useful results right out of the box. As with other benefits, there are also drawbacks that also need to be considered — data privacy, security, performance, and cost optimization. This creates an opportunity to improve the efficiency and performance of the AI-based analysis of Suricata data. In this talk we share — based on hands-on experience, knowledge and new feature additions to Suricata — how to create optimised SKILLs files for AI analysis of Suricata data with the goal of minimizing token cost, hallucinations, and the time spent reviewing results.

Community Discussion Recap

We hope to see you next year!